CVE-2026-42824 SearchLeak: How M365 Copilot Became a One-Click Data Exfiltration Tool

This article describes a critical Microsoft 365 Copilot Enterprise vulnerability that let attackers steal sensitive data via a single malicious link, chaining parameter-to-prompt injection, an HTML rendering race condition, and a Content Security Policy bypass to exfiltrate emails, MFA codes, and files. It argues governance controls at the tool execution layer, not patching alone, are needed to defend against this attack class.